mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-26 21:30:55 +08:00
163 lines
7.5 KiB
Markdown
163 lines
7.5 KiB
Markdown
|
|
tranlating by haimingfg
|
|
|
|
Sleuth Kit - Open Source Forensic Tool to Analyze Disk Images and Recover Files
|
|
================================================================================
|
|
SIFT is a Ubuntu based forensics distribution provided by SANS Inc. It consist of many forensics tools such as Sleuth kit / Autopsy etc . However, Sleuth kit/Autopsy tools can be installed on Ubuntu/Fedora distribution instead of downloading complete distribution of SIFT.
|
|
|
|
Sleuth Kit /Autopsy is open source digital forensics investigation tool which is used for recovering the lost files from disk image and analysis of images for incident response. Autopsy tool is a web interface of sleuth kit which supports all features of sleuth kit. This tool is available for both Windows and Linux Platforms.
|
|
|
|
### Install Sleuth kit ###
|
|
|
|
First of all, download Sleuth kit software from [sleuthkit][1] website. Use wget command to download it in terminal which is shown in the figure.
|
|
|
|
# wget http://cznic.dl.sourceforge.net/project/sleuthkit/sleuthkit/4.1.3/sleuthkit-4.1.3.tar.gz
|
|
|
|
|
|
|
|
Extract the sleuthkit-4.1.3.tar.gz using following command and go inside the extracted directory
|
|
|
|
# tar -xvzf sleuthkit-4.1.3.tar.gz
|
|
|
|
|
|
|
|
Run following command which perform the requirement check before sleuth kit installation
|
|
|
|
#./configure
|
|
|
|
|
|
|
|
Make command compile the sleuth kit code.
|
|
|
|
#make
|
|
|
|
|
|
|
|
Finally following command install it under **/usr/local** path.
|
|
|
|
#make install
|
|
|
|
|
|
|
|
### Install Autopsy Tool ###
|
|
|
|
Sleuth kit installation is complete and now we will install autopsy interface. Download Autopsy software from [sleuthkit's autopsy page][2] . Use wget command to download it in terminal which is shown in the figure.
|
|
|
|
# wget http://kaz.dl.sourceforge.net/project/autopsy/autopsy/2.24/autopsy-2.24.tar.gz
|
|
|
|
|
|
|
|
Extract the autopsy-2.24.tar.gz using following command and go inside the extracted directory
|
|
|
|
# tar -xvzf autopsy-2.24.tar.gz
|
|
|
|
|
|
|
|
Configuration script of autopsy asks for NSRL (National Software Reference Library) and path of **Evidence_Locker** folder.
|
|
|
|
Enter "n" for NSRL prompt and create Evidence_Locker folder under **/usr/local** directory. Autopsy stores the configuration files, audit logs and output under Evidence_Locker folder.
|
|
|
|
#mkdir /usr/local/Evidence_Locker
|
|
|
|
#cd autopsy-2.24
|
|
|
|
#./configure
|
|
|
|
|
|
|
|
After adding Evidence_Locker path in installation process , autopsy stores configuration files in it and shows a following message to run the autopsy program.
|
|
|
|
|
|
|
|
Type **./autopsy** command in terminal to start the graphical interface of Sleuth kit tool.
|
|
|
|
|
|
|
|
Type following address in the web browser to access the interface of autopsy .
|
|
|
|
http://localhost:9999/autopsy
|
|
|
|
Main web page of autopsy plugin is shown int the following figure.
|
|
|
|
|
|
|
|
Click on the **New Case** button to start analysis in autopsy tool. Enter the case name, description about the investigation and name of agent which is shown in the following figure.
|
|
|
|
|
|
|
|
Following web page will appear after entering the details in the above page. Click on **Add Host** button to add details for the analyst machine.
|
|
|
|
|
|
|
|
Enter host name, description and time zone setting of analyst machine on the next page.
|
|
|
|
|
|
|
|
Click on the **Add Image** button to add image file for forensics analysis.
|
|
|
|
|
|
|
|
Click on the **Add Image File** button on the following web page. It opens new web page which require Path of image file and select type & importing method.
|
|
|
|
|
|
|
|
As shown in the following figure, we have entered path of Linux image file. In our case, image file is partition of disk.
|
|
|
|
|
|
|
|
Click on the next button and select **Calculate hash** option in the next page which is shown in the following figure. It also detect the file system type of the given image.
|
|
|
|
|
|
|
|
Following window shows the MD5 hash of the image file before static analysis .
|
|
|
|
|
|
|
|
On the next web page, autopsy shows following information about the image file.
|
|
|
|
- mount point for the image
|
|
- name of image
|
|
- file system type of given image
|
|
|
|
Click on the **details** button to get more information about the given image file. It also offer extraction of unallocated fragments and strings from the volume of image file which is shown in the following figure.
|
|
|
|
|
|
|
|
Click on **Analyze** button which is shown in the below figure to start analysis on given image . It opens another page which shows the multiple options for image analysis.
|
|
|
|
|
|
|
|
Autopsy offer following features during image analysis process.
|
|
|
|
- File Analysis
|
|
- Keyword Search
|
|
- File Type
|
|
- Image Details
|
|
- Data Unit
|
|
|
|
File Analysis on given image of Linux partition is shown in the following figure.
|
|
|
|
|
|
|
|
It extracts all files and folders from the given image . Extraction of deleted files are shown int he figure.
|
|
|
|
|
|
|
|
### Conclusion ###
|
|
|
|
Hopefully this article will be useful for the beginner in static forensics analysis of disk image. Autopsy is web interface for sleuth kit which provides features such as extraction of strings , recovery of deleted files, timeline analysis, extraction of web surfing history, keyword search and email analysis on windows and linux disk images.
|
|
|
|
--------------------------------------------------------------------------------
|
|
|
|
via: http://linoxide.com/ubuntu-how-to/autopsy-sleuth-kit-installation-ubuntu/
|
|
|
|
作者：[nido][a]
|
|
译者：[译者ID](https://github.com/译者ID)
|
|
校对：[校对者ID](https://github.com/校对者ID)
|
|
|
|
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](http://linux.cn/) 荣誉推出
|
|
|
|
[a]:http://linoxide.com/author/naveeda/
|
|
[1]:http://www.sleuthkit.org/sleuthkit/download.php
|
|
[2]:http://www.sleuthkit.org/autopsy/download.php
|